Back to Projects
Oct 2025

Prestige Rentals DB

View Source Code

Project Overview

Prestige Rentals is a full-stack car rental web application designed and developed from the ground up. The primary objective was not only to create a functional platform but to architect it with security and resilience as core design principles. Approaching this from both a software engineering and security analyst perspective, safety practices were prioritized across every layer—from database schemas to client-side logic.

User Experience & Access Control

Customer Experience

Guests can explore the catalog, but authenticated users gain access to:

  • Dashboard: Manage profile, rentals, and payments.
  • Rental Flow: Multi-step process with terms and payment confirmation.
  • Reviews: Verified renters can submit/edit feedback.

Admin Panel

Staff access via role-based API tokens:

  • CRUD Operations: Full control over listings, users, and employees.
  • Fleet Mgmt: Monitor maintenance schedules and availability.
  • RBAC: Protected endpoints ensuring privilege separation.

Database & Backend Architecture

Schema Design & Integrity

The backend is structured around a relational MySQL database with explicit entity relationships:

  • Customers: Stores hashed passwords (bcrypt) and account status.
  • Rentals & Transactions: Atomic operations ensure payments and availability update simultaneously with foreign keys and cascading deletes preventing orphaned records.

Security Implementation

Built-in database and query protections:

  • SQL Injection Defense: All queries use mysql2/promise parameterized statements.
  • Indexing: Composite indexes applied on high-traffic keys like customer_id to optimize query performance.

Defensive Implementation

Auth & Session Management

Securing user credentials and sessions:

  • Password Hashing: Implements bcrypt with unique salts to defend against rainbow tables.
  • JWT Tokens: Signed tokens containing User ID and Role securely manage sessions.

Vulnerability Mitigation

Hardening the server against common exploits:

  • Brute Force Protection: express-rate-limit throttles failed login attempts.
  • Header Hardening: helmet.js enforces HSTS, X-Frame-Options, and anti-sniffing protocols.